3Kj#E RdZddlmZddlZddlZddlmZddlmZddl m Z m Z m Z m Z mZmZmZmZmZddlmZeej-j.dZed z Zed z Zed z Zd Zid ede dddddddddddddddddd d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/e d0Zd1d2d3d4e d5Zd6d7d8d9d:d7d;d9dd9d?d=d@d9dAdBdCd9dDdBdEd9dFdBdGd9dHdBdId9dJdBdKd9dLdMdNd9dO ZdYdPZ dZdQZ!d[dRZ" d\dSZ# d\dTZ$d]dUZ%d^dVZ&d_dWZ'e(dXk(r e)e'y)`aClassify the HUD menu mode/state dispatcher layer. The previous opener/frontier passes proved two negative facts: * The exact #6/#3/#4 top-menu object construction sequence is grounded, but does not directly appear in an input consumer. * Selected-root and global 0x62 descriptor-add scans do not promote a normal-field ESC/X opener. This pass records the next layer down: functions that are clearly menu state/cursor/selector machinery after the HUD menu object already exists. The goal is not to claim the opener; it is to prevent future analysis from treating cursor movement, confirm/cancel handling, or selector-table production as the normal-field opener. ) annotationsN)Path)Any) ADD_DESCRIPTOR_ROUTINE_VAEDGE_ACTION_MASK_VATOP_MENU_OBJECT_SEQUENCE_VA call_sites find_functionfunction_rangeshxrefs_in_function text_refs) read_sectionsz Hwanse2.exeoutwebiYzinput.currentActionMaskzinput.edgeActionMaskzruntime.enabledTableAi`Yzruntime.enabledTableBipYzruntime.menuCategoryi@Yzruntime.menuCursoriJYzruntime.currentDescriptorIndexi>Yzruntime.activeComparisonGroupiDYzmenu.dispatchLatchi(Uzmenu.dispatchStopFlagiUzmenu.cursorMaxiXYzmenu.cursorModeiZYzmenu.cursorSourceOffseti[Yzmenu.cursorYBasei\Yz menu.cursorYi^Yzmenu.soundHandleilYzdescriptor.activeOrderivEiPwEiDwEivE)zdescriptor.rowTablezdescriptor.persistFlagzdescriptor.statusBasetopMenu.objectSequencepAAisBi A)zcall.menuCursorApplyzcall.menuCursorMotionz call.soundCuezcall.availabilityBuildercall.addDescriptorzmenu-internal input dispatcher"confirmed-menu-internal-not-openeru1edge mask를 읽고 이미 존재하는 menu object의 cursor/confirm/cancel 상태를 처리한다. 0x55b128 latch, 0x59db58..0x59db5e cursor globals, 0x59dd6c sound handle, 0x4106ba cursor motion helper, 0x42af73 sound cue를 함께 쓰지만 top-menu object sequence나 descriptor-add 호출은 없다.)label promotiondecisionz+directional input dispatch to cursor helperuinput edge 방향 bit를 해석해 0x410570 cursor helper로 넘기는 방향키 처리층이다. descriptor/materializer 근거가 없어 opener가 아니다.zcursor apply/helperzconfirmed-helperuFcursor movement helper로, 선택 buffer/object state를 갱신한다.zcursor motion/sound helperuQ0x59db5a/5b/5c/5e cursor globals를 소비하는 menu cursor motion 계층이다.zavailability table builderzconfirmed-selector-state-layeruR0x59e360/0x59e370 enabled table을 준비하는 selector availability producer다.zavailability branch consumeruDobject+0xa8 selector와 enabled table 값을 비교해 분기한다.znext enabled row produceruRenabled table에서 다음 선택 가능 row를 찾고 object+0xa8 slot에 쓴다.z'active descriptor row selector produceruVactive descriptor row의 +0x48/+0x4a 값을 비교해 menu selector slot을 만든다.z)persistent menu category/cursor load-saveuactive descriptor row와 0x59e340/0x59e34a 사이에 menu category/cursor 상태를 load/save하는 persistent state handler다.zdisplay VM selector base binderz confirmed-base-binder-not-openeru]display/object VM의 base pointer를 고르는 binder다. opener 증거로 쓰면 안 된다.) Ai;@rri@i@i_@i@iR@iAcVtj|ddSt|dS)NT)quote)htmlescapestr)values 4tools/build_hud_menu_mode_state_dispatcher_review.pyhr$s% ;;U]r$ GGE $ GGc |jDcic]5\}}t||r$|t||Dcgc] }t|c}7c}}}Scc}wcc}}}wNitemsr r )row refs_by_namenamerefsrefs r#refs_for_functionr/s_',,.   D$ C & "23"=>3r#w>> > #AA AAc |jDcic]5\}}t||r$|t||Dcgc] }t|c}7c}}}Scc}wcc}}}wr'r()r* calls_by_namer,r-r.s r#calls_for_functionr3s_(--/   D$ C & "23"=>3r#w>> > r0cg}ttjD]\}}t||}|s&|j |t ||dddiid:t |d}|j |t |t |t t |dt |d|d|d|d t||t||d |S) Nrzmissing-function-rangez3function prologue range not found by static scanner) functionVa functionVaHexrrrrefHitscallHitsstartVaendVasizerr) r5r6requestedVaHexendVaHexr;rrrr7r8) sortedDISPATCHER_FUNCTIONSr)r appendr intr/r3) functionsr+r2rowsvametafunctionstart_vas r#classify_known_functionsrHs "$D/5578 D B/ KK"$%'V!']!9 U! "  x *+ &!#H"$R&s8G#456HV,-g!+. ,,X|D.xG  ! < Kr%c di}|jD])}|D]"}t||}|s||t|d<$+|jD])}|D]"}t||}|s||t|d<$+g} t|jdD]}t ||} t ||} t d| D} t d| D} d| v}d| v}| sJ| s|s|sQ| jtt|dtt|d| | ||| | d | S) Nr9ct|dS)Nr9)rA)items r#z(discover_intersections..sc$y/>Rr%)keyc3>K|]}|jdyw)zinput.N startswith.0r,s r# z)discover_intersections..sGd1Gc3>K|]}|jdyw))zruntime.zmenu.z descriptor.NrOrQs r#rSz)discover_intersections..s"  OO@ A rTrrr:)r6r=inputHit menuStateHit topMenuHitdescriptorAddCallHitr7r8) valuesr rAr>r/r3anyr@r )rBr+r2touchedr-r.rFcallscallrCref_hits call_hits input_hitmenu_state_hittop_hitadd_hits r#discover_intersectionsresp *,G##%= =C$Y4H4<HY/01 == %%'= =D$Y5H4<HY/01 == "$D7>>+1RS$X|<&x? GhGG     +h6&)3 .Gw KK%'HY,?(@%A "3x'8#9 : )$2"),3' )  . Kr%ctj}t|}t||}tj Dcic]\}}|t |||}}}tj Dcic]\}}|t|||}}}t|||}t|||}|D cgc]&} | jds| jdr| (} } |D cgc].} t| jddjdr| 0} } t|t| t|t| td|Dddd } d d d | ||| |j D cic]\}} || Dcgc] }t!|c}!c}} }|j Dcic]\}}||Dcgc] }t!|c}!c}}}gd gdd Scc}}wcc}}wcc} wcc} wcc}wcc}} }wcc}wcc}}}w)NrXrYrr confirmedc3RK|]}|dtdk(xr|ddk(!yw)r6rrrN)r rRr*s r#rSzbuild_report..sB,   BzN 2 IK $HH I, s%'Fu\0x0041d61b 및 0x0040b49e..0x0040b752 계열은 메뉴가 이미 열린 뒤의 cursor/selector/mode-state dispatcher로 분류된다. 이 층은 입력, cursor globals, selector table을 강하게 참조하지만 top-menu object sequence 생성이나 descriptor-add 호출과 연결되지 않으므로 normal-field ESC/X opener 증거가 아니다.)knownDispatcherRowsconfirmedInternalRowsinputMenuStateIntersectionCount,inputTopMenuOrAddDescriptorIntersectionCountmenuInternalDispatcherProvennormalFieldEscOpenerProvenrz,hwanse-hud-menu-mode-state-dispatcher-reviewz4tools/build_hud_menu_mode_state_dispatcher_review.pyz0menu-internal-dispatcher-grounded-opener-pending)zy0x0041d61b reads input edge mask and menu cursor globals, but does not reference 0x004ddc6c and does not call 0x00431fe8.z0x0040b49e..0x0040b752 selector handlers prepare/consume enabled tables and persistent cursor state, not menu object construction.zzThe exact top-menu #6/#3/#4 construction sequence remains data-grounded at 0x004ddc84 with no input-consumer intersection.)zTrace the higher-level field mode/state transition that creates or attaches the top-menu descriptor before 0x0041d61b starts consuming cursor input.zySearch for producers of descriptor stack materialization or selected-root switch, not for cursor/confirm/cancel handlers.zPromote only if a candidate connects input/state transition to the exact 0x004ddc6c top-menu object sequence or its descriptor attachment path.) kindsourcestatussummarydispatcherRowsinputMenuStateIntersectionsopenerLikeIntersections refsByName callsByNamenegativeEvidence nextFrontier)EXE read_bytesrr MENU_STATE_GLOBALSr)r CALL_TARGETSr rHregetr!rPlenr[r )exesectionsrBr,rDr+r2dispatcher_rows intersectionsr* opener_likeconfirmed_internalrsr-r.r]r^s r# build_reportrs' .. CS!HX.I+002 D" iXr**L %**, D" jh++M/y, VO*9lMRM$ 77< CGG,B$C K ' sww{B' ( 3 3K @  #?3!$%7!8+.}+=8;K8H(+, ', ) ', aG&?HD)'4#.IUI[I[I]^^:4t6#bg66^N[NaNaNcdd{tUE:Dr$x::d   K >7^:dsHG5G .+G&3G+- G5:G0 G5) H6G< H0G5<Hc|d}d|dfd|dfd|dfd|dfd |d fd |d fg}d jd|D}d jd|dD}d jd|dD}d jd|dD}d jd|dD}tj|d}dt|dd|d|d|xsdd|d |d!|d"S)#Nrsrrzdispatcher rowsrjzconfirmed internalrkzinput/menu intersectionsrlzopener-like intersectionsrmz opener provenrorc3XK|]"\}}dt|dt|d$yw)z
z z
Nr$)rRkvs r#rSzrender_html..@s/fX\XY[\/!vZ!v]Sfs(*c3^K|]}dt|ddt|ddt|ddt|ddttj|jd id dttj|jd id d yw)r6z
r rz
rzr7F ensure_asciir8 N)r$jsondumpsrris r#rSzrender_html..As   s?+,-[3w<8IJ[!"##:1S_;M:NOCGGIr2GHIJCGGJ3%HIJK  sB+B-rtc 3K|]^}dt|ddttj|dddttj|ddd`y w) rr6zr7Frrr8rN)r$rrris r#rSzrender_html..Jst   s?+,-.C N?@ABC O%@ABC sA$A&ruc3:K|]}dt|dywz
  • z
    • NrrRrKs r#rSzrender_html..RsU$$qwiu-Uryc3:K|]}dt|dywrrrs r#rSzrender_html..SsPagYe,PrrzFra) HUD Menu Mode/State Dispatcher Review
    index opener frontier selected-root frontier HUD menu preview JSON

    HUD Menu Mode/State Dispatcher Review

    rz

    z

    Confirmed Dispatcher/Selector Layer

    z
    functionclassificationrefscalls

    Input + Menu-State Intersections

    z@zV
    functionrefscalls
    No input/menu-state intersections.

    Negative Evidence

      zB

    Next Frontier

      z

    Raw JSON

    
  
    

    



)joinrrr$)	reportrscards	card_htmlrC
inter_rows	negativesfrontierpayloads	         r#render_htmlr6sYG	6(#$	G$9:;	w'>?@	#W-N%OP	$g.\&]^	'">?@

Ef`effI
77*+D78
JU&AS:TUUIwwP9OPPHjje4G#F
!{#
V^^
_`	

	

78?i@CFFr%c2t}tjdtjdtdzj	tj|dddzd	td
zj	t|d	tdy)
NT)exist_okz*hud_menu_mode_state_dispatcher_review.jsonF)rindent
zutf-8)encodingz*hud_menu_mode_state_dispatcher_review.htmlz(hud_menu_mode_state_dispatcher_review okr)	rOUTmkdirWEB
write_textrrrprint)rs r#mainrs
^FIItIIItI77CC

6a84?D	77CCKPVDWbiCj	
45r%__main__)r"rreturnr!)r*dict[str, Any]r+dict[str, list[int]]rdict[str, list[str]])r*rr2rrr)rBlist[dict[str, Any]]r+rr2rrr)rr)rrrr!)rrA)*__doc__
__future__rrrpathlibrtypingr%build_hud_menu_opener_frontier_reviewrrrr	r
rrr
rprobe_exe_scene_tablesr__file__resolveparentsROOTr{rrCURRENT_ACTION_MASK_VAr}r~r?r$r/r3rHrerrr__name__
SystemExitr%r#rs#


1H~''*
]
Ul
Ul#5/ZZ	
J*
%j$Z*Zjzz
J 
!"j#$&('9+2'' *329
K		?9
L	''\.'g.5h05Z-5h;5l=5
;	37ss>BH$#$&$($	$N)#)&)()	)X>BeP

z
TV
r%